Summary

This final rule makes amendments to the Clinical Laboratory
Improvement and Amendments of 1988 (CLIA) regulations and the
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Privacy Rule to provide individuals the right to receive their test
reports directly from laboratories. Under this final rule, patients
(and their authorized personal representatives) have the right to
receive requested laboratory results within 30 days of making a
request. In a 2011 comment letter on the corresponding proposed
rule, the College indicated that these changes were "broadly
consistent with College policy that promotes the transparency of a
patient's healthcare information."2 The College
furthermore recommended that all directly accessed laboratory
reports include a standard statement that provides general guidance
on understanding lab results to limit misinterpretation—"both
unwarranted concerns and inappropriate reassurances"—and encourages
patients to review the results with the ordering physician or
healthcare professional. The final rule does not require the
recommended statement.

The mandating of direct access to laboratory reports was also
supported by multiple additional stakeholders including patient
advocate groups, other physician/healthcare professional
organizations, health policy experts, health plans, test laboratory
organizations, and various health information technology groups.
Benefits anticipated include allowing patients to have increased
control over their personal health information, facilitating their
ability to receive this information in a timelier manner, and, in
general, appropriately reinforcing patients' active participation
in their healthcare.

What laboratories does this rule specifically
affect?

The rule mandating direct access to requested laboratory
information covers all CLIA and CLIA-Exempt laboratories covered
under HIPAA3. In essence, the rule covers almost all
laboratories used by our members.

Who can request the laboratory results?

The laboratory results can be directly requested by the patient
and the patient's authorized representative or given to another
person or entity specifically designated by the patient or
authorized representative.

Are there any exceptions to the release of this
information directly to the patient?

There is a limited exception for cases where a licensed health
care professional has determined, in the exercise of professional
judgment, that the access requested is reasonably likely to
endanger the life or physical safety of the individual or another
person. Under this limited exception, the requesting individual is
provided a right to have the denial of access reviewed by an
unaffiliated health care professional.

How must covered laboratories handle requests from
individuals for direct access to their results?

The rule, in recognition of the varied circumstances of each
laboratory, provides laboratories with substantial flexibility
regarding the systems used to receive, authenticate, process, and
respond to requests for access to laboratory results by
individuals.

Is the laboratory required to provide any interpretation
with the results?

The final rule does not require laboratories to interpret test
reports for individuals. However, while not required, a laboratory
may also provide additional educational or explanatory materials
regarding the test results to individuals if it chooses to do
so.

How must the information be provided?

The laboratory is required to provide the Individual with a copy
of the requested information in the form and format requested by
the individual, if a copy in that form or format is readily
producible. If not, the copy must be either a readable hard copy or
in another form or format as agreed to by the covered entity and
the individual.

How does the final rule address concerns about patients
receiving test reports without physician or other qualified
healthcare professional interpretation?

Commentary emphasizes that this rule does not alter the role of
the ordering or treating physician and qualified other healthcare
professional in reporting and explaining test results to patients.
It is expected that patients will continue to obtain test results
and advice about what those test results mean through their
ordering or treating physician and other qualified healthcare
professional. Further, for those individuals who do or will request
access to test reports from a laboratory, it was the experience of
one large laboratory that many patients do not request access to
their test reports from a laboratory until they have spoken with
their physicians.

Furthermore, it is believed that the rule will further
encourage ordering and treating physicians and other qualified
healthcare professionals to more proactively discuss with patients
the range of possible test results and what the results may mean
for the particular patient before or at the time the test is
ordered.

Finally, laboratories will be required to provide individuals
with access to their laboratory test reports within 30 days of the
request. It is believed that 30 days will generally be sufficient
to allow the ordering or treating physician or other qualified
healthcare professional to receive the test report in advance of
the patient's receipt of the report, to communicate the result to
the patient, and counsel the patient as necessary with regard to
the result.

Are ordering physicians and other healthcare
professionals required to inform their patients of their right to
direct access to their laboratory results?

The rule encourages, but does not require, treating health care
professionals to inform individuals of their right to receive test
reports directly from HIPAA-covered laboratories. It was believed
that requiring doing so would create an unwarranted burden.

The rule does require laboratories to modify their HIPAA privacy
notices to specify the right to direct access of their laboratory
results.

Does the rule pre-empt related state laws?

This final rule pre-empts all related state laws, except those
that require greater access (e.g. information needs to be provided
in less than 30 days) than indicated in this final rule.

Which states are affected by this final
rule?

Currently, only the following states allow direct access to
laboratory results:

Delaware
District of Columbia
Maryland
New Hampshire
New Jersey
Nevada
Oregon
Puerto Rico
West Virginia

Thus, this final rule affects all other states/territories,
which have no law regarding receipt of test reports, require the
report to only go to the physician or other qualified healthcare
professional, or allow direct access only with physician or other
qualified healthcare professional approval.4

When does this final rule take effect?

HIPAA-covered laboratories have a total of 240 days after
publication of this final rule in the Federal Register to come into
compliance. The rule was published on February 6, 2013; thus full
compliance for HIPAA covered laboratories is required as of October
6, 2014.